Axios 1.15-1.17 Loopback 0.0.0.0 Proxy Bypass
CVE-2026-67315 Published on August 1, 2026
axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
Vulnerability Analysis
CVE-2026-67315 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an Allowlist / Allow List Vulnerability?
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
CVE-2026-67315 has been classified to as an Allowlist / Allow List vulnerability or weakness.
Products Associated with CVE-2026-67315
Want to know whenever a new CVE is published for Axios? stack.watch will email you.
Affected Versions
axios:- Version 1.15.0 and below 1.18.0 is affected.
- Version 1.18.0 is unaffected.
- Version 0.31.0 and below 0.33.0 is affected.
- Version 0.33.0 is unaffected.